QUESTION: 5

An analyst navigates to the alerts page in Endpoint Standard and sees the following:
What does the yellow color represent on the left side of the row?

It is an alert from a watchlist rather than the analytics engine.
It is a threat alert and warrants immediate investigation.
It is an observed alert and may indicate suspicious behavior.
It is a dismissed alert within the user interface.

Answer(s): A

Show Answer Next Question

An administrator is concerned that someone may be using unauthorized commands from cmd.exe. These commands are not considered suspicious or malicious, and there is no policy based around them.
Which page should the administrator use to find these commands?

Sensor Management
Investigate
Policies
Alerts

Answer(s): A

Show Answer Next Question

QUESTION: 7

An analyst has investigated multiple alerts on a number of HR workstations and found that java.exe is attempting to PowerShell. Of the Windows workstations in question, the analyst has also found that Java is installed in multiple locations. The analyst needs to block java.exe from this type of operation.
Which rule meets this need?

**/java.exe --> Invokes an untrusted process --> Terminate process
**/Program Files/*/java.exe--> Invokes an untrusted process --> Deny operation
**\Program Files\*\java.exe --> Invokes a command interpreter --> Terminate process
**\java.exe --> Invokes a command interpreter --> Deny operation

Answer(s): C

Show Answer Next Question